GovOPlaN/govoplan-files
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases Wiki Activity

Fail closed for SMB referral transports

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 15:43:56 +02:00
parent d5d0df792b
commit 5248e7de4a
7 changed files with 58 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/CONNECTOR_BOUNDARY.md
View File

@@ -60,9 +60,10 @@ Every provider must:
- use a transport that pins every connection to a policy-validated DNS/IP answer
and revalidates redirects; SDK transports without that guarantee fail closed
SMB DNS endpoints therefore fail closed in private-network mode until the SDK
supports connection-time pinning; explicit IP endpoints remain available. Live
S3 access is disabled in all modes until `boto3`/botocore can be bound to the
Live SMB access is disabled in all modes until `smbprotocol` initial connections
and DFS referral targets can be pinned and policy-validated. An explicit IP is
not sufficient because the server may still issue a referral to another peer.
Live S3 access is likewise disabled until `boto3`/botocore can be bound to the
pinned transport, including SDK-managed redirects and endpoint discovery.
## Non-Goals For Files